Choose lab screenshots by the claim each one supports, not by how many setup steps you completed.
A small set of labeled images should explain the scenario, configuration, and tested result. A screenshot without account context or an explanation may show very little about your IAM understanding.
For a simple access-control project, the five options below cover the permission relationship, resource, allowed action, denial, and a changed state. Adjust the selection to the project; don't manufacture an extra image just to reach a fixed number.
Show the intended identity and group relationship
The first image should establish the relevant fictional account and membership, not display the entire directory.
Crop it to the information needed for the explanation. Label which identity is being tested and which group is supposed to provide access.
The caption might say: “The test employee belongs to the read-access group used in this scenario.”
That screenshot does not prove the resource permission is correct. It establishes one part of the path that the next evidence needs to connect.
Show the permission on the actual resource
The second image should show the relevant permission assignment for the folder, application, or other resource in scope.
Explain the action it is intended to allow. “Read access” is more useful than “permissions configured.”
Microsoft's Windows access-control overview provides background on permissions and related concepts. Your image should show the specific configuration you tested.
Check for inherited or alternate assignments that affect the conclusion. Do not crop away a relevant permission merely because it complicates the story.
Show the allowed action under the test identity
The third image should demonstrate the intended user performing the intended action.
Make the account context understandable without exposing real personal information. A successful action performed as an administrator would not demonstrate the same boundary.
The caption should name the action and the result: “The authorized test account opened the approved document for reading.”
A desktop full of unrelated windows makes this harder to evaluate. Keep the image focused and preserve the unedited evidence privately if you need it for your own review.
Show a comparable denied action
The fourth image should show the comparison account or prohibited action failing for the intended access reason.
Do not use a network failure as proof of authorization. Confirm that the test reached the relevant system under the conditions you intended.
Explain the expected denial and the observed result. A red message with no context is not self-explanatory evidence.
Proving that access was denied for the right reason is a useful companion when you are unsure whether the negative test actually supports the claim.
Show the result after removal or correction
Use the final image to document a meaningful change, such as removing access or correcting a controlled configuration error.
Its caption should identify:
- The change: What was removed or corrected.
- The test identity: Which account performed the action.
- The conditions: Any refreshed session or other state needed to interpret the result.
- The comparison: Whether the same resource and action were used before and after.
This closes the investigation by showing that you tested a change, rather than capturing one moment when the setup happened to work.
If the scenario has no meaningful changed state, a concise result table may be more appropriate.
Keep captions consistent with the written test record. Don't mix accounts or later configurations in a way that makes the image appear to support a conclusion the actual test never established.
Remove sensitive details before publishing
Review account names, tenant identifiers, internal domains, paths, tokens, keys, and background windows. Use fictional lab identities from the start rather than trying to sanitize production evidence later.
The three lab areas in The Six-Figure IAM Career Playbook give you concrete scenarios to document. The $9 guide helps turn the evidence into a portfolio that supports a career move.
Five useful images with clear captions can explain more than fifty unlabeled screenshots. The objective is inspectable evidence, not a record of every click.